In order to allow signed images to be deployed with Google Cloud Platform's binary authorization enabled, you need to create a(n) _.